# Two-step sign-in (2FA) with an authenticator app

This page contains AI-generated content.

> Protect your Capitality account with 2FA: after password, Google or Microsoft, a code from Google Authenticator, Microsoft Authenticator or 1Password.

**Status:** Beta — Complete for the first firms using it; details may still move.
**On the broker’s path:** Platform

**The problem this solves:** A leaked password opens the whole client file of the firm: contacts, owners, prices, deals.

**In short:** With two-step sign-in, Capitality asks for a six-digit code from an
authenticator app on your phone after your password or after signing in with Google or Microsoft. Someone
who knows your password does not get into your account without your phone — and so not to
your firm's contacts, objects and deals. You switch on two-factor authentication (2FA) in the
settings in two minutes.

## What you can do

- **Protect your account.** A stolen or guessed password alone is no longer enough: the code
  changes every 30 seconds and is made only on your phone.
- **Use the app you like.** Google Authenticator, Microsoft Authenticator, 1Password,
  Bitwarden, Authy — any app with time-based codes (TOTP).
- **Get in without your phone.** Ten backup codes, each valid once, for the day the phone is
  not at hand.
- **Give trusted devices a rest.** „Trust this device for 30 days“ — on your office computer
  Capitality then does not ask again for a month.
- **With Google and Microsoft too.** Two-step sign-in also applies after
  [Google](https://docs.capitality.io/features/google-sign-in/) or [Microsoft](https://docs.capitality.io/features/microsoft-sign-in/).

## How to set it up

1. Open **Settings → Profile**, section **Security**, and click **„Set up two-step
   sign-in“**.
2. Confirm with your password. (An account you made with Google has none; Capitality then does
   not ask for it.)
3. Scan the QR code with your authenticator app. If scanning does not work, type the key shown
   below it into the app.
4. Enter the code the app shows — two-step sign-in is now on.
5. Save the backup codes: download them and keep them somewhere safe, for example in your
   password manager. They are shown only once.

## How you sign in

After your password, Google or Microsoft, Capitality opens the **„Enter your code“** page. Type the
current code from the app, or choose **„Use a backup code instead“**. The page waits ten
minutes; after that you sign in again.

## Limits and notes

- **Wrong codes.** After several wrong codes you sign in again; after many failed attempts
  Capitality locks sign-in for a while.
- **Your phone's clock.** The codes depend on the time. If your phone's clock is off, the codes
  do not match — set the time to automatic.
- **New backup codes.** „New backup codes“ makes the old ones invalid; Capitality asks for your
  password for it.
- **Switching off.** Only you switch two-step sign-in off, with your password. An admin of your
  firm cannot do it for you.
- **Required for the whole firm.** A rule „2FA for all members“ does not exist at the moment;
  each person decides for their own account.
- **Phone and backup codes lost.** Use the form
  [„Cannot get into your account?“](https://app.capitality.io/account-help) — it is linked on the
  „Enter your code“ page too. We check that the account is yours before we help.

## Frequently asked questions

**Which authenticator app can I use?**
Any app with time-based codes (TOTP), for example Google Authenticator, Microsoft
Authenticator, 1Password, Bitwarden or Authy.

**Does Capitality ask for the code after signing in with Google or Microsoft too?**
Yes, whether you signed in with your password, Google or Microsoft.

**What do I do when my phone is gone?**
Sign in with a backup code, set up the app on the new phone and get new backup codes.

## New in this feature

No published change to this feature yet.

---

HTML version: https://docs.capitality.io/features/two-step-sign-in/ · Language: en